fittings-fec-financial-totals

SUSPICIOUS. The skill’s stated purpose is coherent, but its actual footprint is broader than necessary: it routes requests through a third-party gateway, asks for a blockchain private key, and recommends downloading and executing an unverifiable remote client script. The strongest risk is credential forwarding to fetched code, which triggers high supply-chain concern even without proof of malicious intent.